Bulletins | CERT@VDE

Moxa MGate Protocol Gateways

Title

Moxa MGate Protocol Gateways

Published

Dec. 23, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-357-01

Summary

This advisory contains mitigations for a Cross-site Scripting vulnerability in the Moxa MGate Protocol Gateways, a serial-to-Ethernet Modbus gateway.

23.12.2021

Johnson Controls exacq Enterprise Manager

Title

Johnson Controls exacq Enterprise Manager

Published

Dec. 23, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-357-02

Summary

This advisory contains mitigations for an Improper Input Validation vulnerability in the Johnson Controls exacq Enterprise Manager tool.

Fresenius Kabi Agilia Connect Infusion System

Title

Fresenius Kabi Agilia Connect Infusion System

Published

Dec. 21, 2021, 4:25 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsma-21-355-01

Summary

This advisory contains mitigations for several vulnerabilities in the Fresenius Kabi Agilia Connect Infusion System.

https://us-cert.cisa.gov/ics/advisories/icsa-21-355-01

mySCADA myPRO

Title

mySCADA myPRO

Published

Dec. 21, 2021, 4:20 p.m.

URL

Summary

This advisory contains mitigations for Authentication Bypass Using an Alternate Path or Channel, Use of Password Hash with Insufficient Computational Effort, Hidden Functionality, and OS Command Injection vulnerabilities in the mySCADA myPRO HMI/SCADA system.

Horner Automation Cscape EnvisionRV

Title

Horner Automation Cscape EnvisionRV

Published

Dec. 21, 2021, 4:15 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-355-02

Summary

This advisory contains mitigations for an Improper Input Validation vulnerability in Horner Automation Cscape EnvisionRV industrial remote viewing software.

Schneider Electric Rack PDU (Update A)

Title

Schneider Electric Rack PDU (Update A)

Published

Dec. 21, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-348-02

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-21-348-02 Schneider Electric Rack PDU that was published December 14, 2021, to the ICS webpage on www.cisa.gov/uscert. This advisory contains mitigations for an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Schneider Electric Rack Power Distribution Unit ...

17.12.2021

Siemens SINUMERIK Edge

Title

Siemens SINUMERIK Edge

Published

Dec. 17, 2021, 4:36 a.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-09

Summary

This advisory contains mitigations for an Improper Certificate Validation vulnerability in the Siemens SINUMERIK Edge hardware and software digital production support and optimization platform.

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-01

Xylem AquaView

Title

Xylem AquaView

Published

Dec. 16, 2021, 4:52 p.m.

URL

Summary

This advisory contains mitigations for a Use of Hard-coded Credentials vulnerability in the Xylem AquaView SCADA system.

Wibu-Systems CodeMeter Runtime

Title

Wibu-Systems CodeMeter Runtime

Published

Dec. 16, 2021, 4:48 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-03

Summary

This advisory contains mitigations for an Improper Privilege Management vulnerability in the Wibu-Systems CodeMeter Runtime server.

Mitsubishi Electric GX Works2

Title

Mitsubishi Electric GX Works2

Published

Dec. 16, 2021, 4:46 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-04

Summary

This advisory contains mitigations for an Improper Handling of Length Parameter Inconsistency vulnerability in #Mitsubishi Electric's GX Works2 engineering software.

Mitsubishi Electric FA Engineering Software

Title

Mitsubishi Electric FA Engineering Software

Published

Dec. 16, 2021, 4:44 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05

Summary

This advisory contains mitigations for Out-of-bounds Read, and Integer Underflow vulnerabilities in Mitsubishi Electric's FA Engineering Software engineering software.

Siemens Capital VSTAR

Title

Siemens Capital VSTAR

Published

Dec. 16, 2021, 4:42 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-06

Summary

This advisory contains mitigations for a several vulnerabilities in Siemens Capital VSTAR software platform products using Nucleus NET, the networking stack of Nucleus RTOS (real-time operating system).

Siemens POWER METER SICAM Q100

Title

Siemens POWER METER SICAM Q100

Published

Dec. 16, 2021, 4:40 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-07

Summary

This advisory contains mitigations for a Stack-based Buffer Overflow vulnerability in the Siemens POWER METER SICAM Q100 power monitoring device.

Siemens JTTK and JT Utilities

Title

Siemens JTTK and JT Utilities

Published

Dec. 16, 2021, 4:38 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-08

Summary

This advisory contains mitigations for Out-of-bounds Write, Use after Free, Out-of-bounds Read vulnerability in in the Siemens JTTK programming interface, and JT Utilities series of command line utilities.

14.12.2021

Schneider Electric Rack PDU

Title

Schneider Electric Rack PDU

Published

Dec. 14, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-348-02

Summary

This advisory contains mitigations for a Cross-site Scripting vulnerability in Schneider Electric Rack Power Distribution Unit (PDU).

14.12.2021

Hillrom Medical Device Management (Update A)

Title

Hillrom Medical Device Management (Update A)

Published

Dec. 14, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsma-21-152-01

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-21-152-01 Hillrom Medical Device Management that was published June 1, 2021, to the ICS webpage at www.cisa.gov/uscert. This advisory contains mitigations for a Out-of-Bounds Write, an d Out-of-Bounds Read vulnerabilities in Hillrom Welch Allyn medical device management tools.

09.12.2021

Hillrom Welch Allyn Cardio Products

Title

Hillrom Welch Allyn Cardio Products

Published

Dec. 9, 2021, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsma-21-343-01

Summary

This advisory contains mitigations for an Authentication Bypass Using an Alternate Path or Channel vulnerability in Hillrom Welch Allyn cardiology devices.

09.12.2021

Hitachi Energy GMS600, PWC600, and Relion

Title

Hitachi Energy GMS600, PWC600, and Relion

Published

Dec. 9, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-343-01

Summary

This advisory contains mitigations for an Improper Access Controls vulnerability in Hitachi Energy GMS600, PWC600, and Relion circuit breaker monitoring systems.

07.12.2021

Hitachi Energy RTU500 OpenLDAP

Title

Hitachi Energy RTU500 OpenLDAP

Published

Dec. 7, 2021, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-341-01

Summary

This advisory contains mitigations for Type Confusion, and Reachable Assertion vulnerabilities in Hitachi Energy RTU500 OpenLDAP firmware.

07.12.2021

Hitachi Energy XMC20 and FOX61x

Title

Hitachi Energy XMC20 and FOX61x

Published

Dec. 7, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-341-02

Summary

This advisory contains mitigations for Weak Password Requirements, and Missing Handler vulnerabilities in Hitachi Energy XMC20 and FOX61x multi-service network elements.

07.12.2021

FANUC Robot Controllers

Title

FANUC Robot Controllers

Published

Dec. 7, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-243-02

Summary

This advisory is a follow-up to the original advisory titled ICSA-21-243-02P FANUC Robot Controllers that was posted to the HSIN ICS library on August 31, 2021. This advisory contains mitigations for Integer Coercion Error, and Out-of-bounds Write vulnerabilities in FANUC Robot Controllers.

02.12.2021